2026년 10월 10일 (토) 오후 6:33, Salvatore Bonaccorso <[email protected]>님이 작성: > > Source: libhangul > Version: 0.2.0-1 > X-Debbugs-CC: [email protected] > Severity: important > Tags: security upstream > Forwarded: https://github.com/libhangul/libhangul/issues/106 > > Hi, > > The following vulnerability was published for libhangul. > > CVE-2026-108063[0]: > | A flaw was found in libhangul. When parsing Hanja dictionary files, > | the library fails to verify that an entry contains a valid value > | alongside its key. By providing a specially crafted dictionary file > | to an application that queries it, an attacker can trigger an > | unexpected application crash, resulting in a Denial of Service > | (DoS).
IMO it's exaggerated. Debian is not affected. Attackers can never provide a specially crafted dictionary file, as all apps using libhangul don't support user provided dictionaries and just load files in a fixed path. Input methods usually work like this. Resulting in DoS? I believe that the reporter had no idea about what libhangul is for.
